== Meeting information == * #ubuntu-meeting: Weekly Main Inclusion Requests status meeting, started by slyon, 14 Feb at 15:29 — 15:51 UTC. * Full logs at https://ubottu.com/meetingology/logs/ubuntu-meeting/2023/ubuntu-meeting.2023-02-14-15.29.log.html == Meeting summary == === current component mismatches === Discussion started by slyon at 15:30. * ''LINK:'' https://people.canonical.com/~ubuntu-archive/component-mismatches-proposed.svg (slyon, 15:30) * ''LINK:'' https://people.canonical.com/~ubuntu-archive/component-mismatches.svg (slyon, 15:30) === New MIRs === Discussion started by slyon at 15:38. * ''LINK:'' https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&assignee_option=none&field.assignee=&field.subscriber=ubuntu-mir (slyon, 15:38) === Incomplete bugs / questions === Discussion started by slyon at 15:39. * ''LINK:'' https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.subscriber=ubuntu-mir (slyon, 15:39) === MIR related Security Review Queue === Discussion started by slyon at 15:42. * ''LINK:'' https://bugs.launchpad.net/~ubuntu-security/+bugs?field.searchtext=%5BMIR%5D&assignee_option=choose&field.assignee=ubuntu-security&field.bug_reporter=&field.bug_commenter=&field.subscriber=ubuntu-mir (slyon, 15:42) * ''LINK:'' https://warthogs.atlassian.net/jira/software/c/projects/SEC/boards/594 (slyon, 15:42) * ''LINK:'' https://bugs.launchpad.net/ubuntu/+source/log4cplus/+bug/2003549 -- currently unassigned, I'm wondering if this ought to be back on the server team (sarnold, 15:43) === Any other business? === Discussion started by slyon at 15:50. == People present (lines said) == * slyon (66) * sarnold (18) * didrocks (14) * eslerm_ (7) * meetingology (2) * joalif (2) * jamespage (2) == Full log == 15:29 #startmeeting Weekly Main Inclusion Requests status 15:29 Meeting started at 15:29:21 UTC. The chair is slyon. Information about MeetBot at https://wiki.ubuntu.com/meetingology 15:29 Available commands: action, commands, idea, info, link, nick 15:29 Ping for MIR meeting - didrocks joalif slyon sarnold c_paelzer jamespage eslerm 15:30 #topic current component mismatches 15:30 Mission: Identify required actions and spread the load among the teams 15:30 #link https://people.canonical.com/~ubuntu-archive/component-mismatches-proposed.svg 15:30 #link https://people.canonical.com/~ubuntu-archive/component-mismatches.svg 15:30 Let's start with -proposed (it's pretty crowded) 15:30 o/ 15:30 good morning o/ 15:31 devscripts: I created a draft MIR for libdigest-md5-file-perl to hand it out to the foundations team 15:31 o/ 15:31 good morning 15:31 devscripts: libswitch-perl has been in main in the past 15:31 I wonder if we can just re-propote it? It's looking pretty healty from a quick sanity check 15:31 bug #785607 15:32 hey 15:32 I guess this is a question for didrocks, jamespage or maybe sarnold if we did have some precendene on that in the past? (see my latest comment on that bug) 15:32 so, in the past, that was a repromotion without question 15:33 but now, we have stricter requirements 15:33 in term of testing and so on 15:33 testing is covered for this one 15:33 so, I would reask for a template + a full review if the package was promoted before those requirements 15:33 OK 15:33 just for a sanity check 15:33 I will hand it out to the team then. 15:33 thanks 15:33 yw 15:33 continuting with c-m-p 15:33 logcheck and the seeds are false-positives 15:34 libsub-quote-perl: I dropped that recommend an hour ago, so it should vanish from the report 15:34 \o/ 15:34 ceilometer: looking good, I think we can promote python-xmltodict. But we'll talk about that in our "updates" section 15:35 cups-browserd: boths deps pending security review 15:35 flashrom: I dropped the new libjaylink dependency/functionality (until somebody in Ubuntu actually wants to use it). So it should vanish, too 15:36 jaraco.text: this is with the openstack-team to fix things (cc jamespage) 15:36 netplan.io: mdurl & mardown-it-py are pending security review 15:36 ack re jaraco.text 15:36 rich: this should be tagged for security review, too (cc sarnold, eslerm_) - see my latest comment on the bug 15:37 pkgconf: looking good, ready for promotion. I prepared a seed change eralier today, to switch pkg-config -> pkgconf. Pending review from my teammates 15:37 licensecheck: pending MIR by a collegue of mine 15:37 policykit-1: pending sec-review 15:38 for c-m: nothing new. libsub-quote-perl got resolved in -proposed as stated earlier 15:38 #topic New MIRs 15:38 Mission: ensure to assign all incoming reviews for fast processing 15:38 #link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&assignee_option=none&field.assignee=&field.subscriber=ubuntu-mir 15:38 \o/ 15:38 slyon: we may have skipped non-proposed 15:39 Nothing \o/ (we might still have some work left from last week) 15:39 (and yes) 15:39 sarnold: "for c-m: nothing new. libsub-quote-perl got resolved in -proposed as stated earlier" (see above) 15:39 oh! I see it now 15:39 #topic Incomplete bugs / questions 15:39 Mission: Identify required actions and spread the load among the teams 15:39 #link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.subscriber=ubuntu-mir 15:39 bug #2007279 15:40 (draft to be handed out to the foundations team to fill the template) 15:40 bug #2003083 15:40 draft to be filled by the foundations team (tracking update) 15:40 bug #2002576 15:40 This got security ACK 15:41 and MIR ACK. it's being pulled in already by ceilometer 15:41 openstack team is subscribed 15:41 so I think it's ready for promotion 15:41 didrocks: could you handle this? 15:41 ack 15:41 sure 15:41 thx! 15:41 and that's all for recent updates 15:42 #topic MIR related Security Review Queue 15:42 Mission: Check on progress, do deadlines seem doable? 15:42 #link https://bugs.launchpad.net/~ubuntu-security/+bugs?field.searchtext=%5BMIR%5D&assignee_option=choose&field.assignee=ubuntu-security&field.bug_reporter=&field.bug_commenter=&field.subscriber=ubuntu-mir 15:42 #link https://warthogs.atlassian.net/jira/software/c/projects/SEC/boards/594 15:42 sarnold: how are things looking? 15:42 mm, is log4cplus overlooked / neglected? 15:43 https://bugs.launchpad.net/ubuntu/+source/log4cplus/+bug/2003549 -- currently unassigned, I'm wondering if this ought to be back on the server team 15:43 log4cplus is older than last week's meeting. 15:43 (and pending input from the MIR reporter) 15:43 athos: ^^ https://bugs.launchpad.net/ubuntu/+source/log4cplus/+bug/2003549 15:43 there we go, now my conscience is clean :) 15:44 sarnold: nice. I've also assigned the bug accordingly 15:44 so, security queue, I'm feeling good with our current position; this is the closest we've bbeen to getting things done before feature freeze, ever :) 15:44 that's very nice to hear. Kudos to the security team! 15:44 there's enough on our plate that I don't think *everything* will be done before feature freeze, but it's hard to guess where exactly the misses might be :( 15:44 yes, this is great to hear :) 15:45 anyway, this feels good. thanks everyone for the help :) 15:45 could we get this into the security queue: https://bugs.launchpad.net/ubuntu/+source/rich/+bug/2003570 ? 15:45 (still fine post-ff, but should be this cycle) 15:45 sarnold: just be informed that I’m assigning the cups* transition to the security. I feel the first promotion to main were done before the MIR process was created. There are quite some gaps and some components are quite critical (running as root, setuid, parsing data format) 15:46 maybe, could you review SEC-1640 privately in JIRA? 15:46 even if it’s monitored for CVE, I think it’s the right time for a re-review 15:47 hmm, I wonder if we should re-poke upstream, how long ago was that? 15:47 almost a week now 15:48 I could assign CVEs and move on with review 15:48 pcs is taking my priority currently though 15:48 didrocks: with a project that mature and (i'm guessing underresourced) it might be a challenge to get sweeping architectural changes of the sort that we'd expect from projects these days :( setuid executables parsing things isj ust a horrible feeling.. 15:49 I've gotten the impression completing the pcs stack is our top priority at the moment, I think that should continue 15:49 but a quick re-poke of upstream is cheap enough / easy enough 15:49 can do 15:49 who will do that poking of upstream? 15:49 thank you! 15:50 #topic Any other business? 15:50 rich https://warthogs.atlassian.net/browse/SEC-1694 15:50 none here 15:50 sarnold: thanks! 15:51 nothing here, thanks! 15:51 none 15:51 none either 15:51 alright folks, that's all for today :) o/ 15:51 #endmeeting Generated by MeetBot 0.4.0 (https://wiki.ubuntu.com/meetingology)